[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: autoconf-2.62 doesn't build on RHEL4

From: Eric Blake
Subject: Re: autoconf-2.62 doesn't build on RHEL4
Date: Tue, 22 Apr 2008 06:18:07 -0600
User-agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: Gecko/20080213 Thunderbird/ Mnenhy/

Hash: SHA1

According to Ralf Corsepius on 4/21/2008 11:49 PM:
| I am not upgrading the distro. I want to enable to developers to work on
| my sources. Therefore, I am shipping autoconf+automake add-on packages
| (Installed to /opt/...).
| ... now, autoconf is forcing me to also ship gm4.
| To me, this is a massive regression on autoconf's part.

I'm sorry you feel this is a regression, but autoconf has required gm4 for
ages, and only now are we enforcing that gm4 is new enough to not silently
generate broken configure files.

| What will be next - bash-X, gawk-Y?

No.  The resulting configure scripts do not depend on a particular bash or
gawk version, so why should autoconf itself?  In other words, it could be
considered a regression if we added a dependence on a tool that we had not
previously depended on.  But we have depended on working gm4 and perl for

| These distros are ultra-conservative, ... security fixes only, and
| hardly any upgrades ever.

And m4 1.4.4 and earlier have KNOWN security bugs.  Your distro is doing
you a disservice by not upgrading it.  Even m4 1.4.10 has a known stack
overrun/arbitrary code execution bug when abusing the -F option that was
only fixed in 1.4.11.  And guess what - autoconf uses the -F option (at
least autoconf doesn't tickle the m4 bug in the normal use case of
portable file names).

- --
Don't work too hard, make some time for fun as well!

Eric Blake             address@hidden
Version: GnuPG v1.4.9 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org


reply via email to

[Prev in Thread] Current Thread [Next in Thread]